Fail delete in IRP_MJ_CLEANUP

NTFSD
1

Can I prevent deletion of files in IRP_MJ_CLEANUP. (Permanent Delete not
recycle bin ) I can catch them in IRP_MJ_CLEANUP as

irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);

I am aware of the way with SET_INFORMATION -> FileDispositionInformation
but want to do it in IRP_MJ_CLEANUP. Any ideas?

Anurag

2

IIRC files marked for deletion by using the CREATE option:
FILE_DELETE_ON_CLOSE cannot be revoked.

Other than that detail, you could send a SET_INFORMATION ->
FileDispositionInformation = 0 before the CLEANUP to clear any other cases.

/ted

-----Original Message-----
From: Anurag Sarin [mailto:xxxxx@divassoftware.com]
Sent: Tuesday, October 26, 2004 1:19 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Fail delete in IRP_MJ_CLEANUP

Can I prevent deletion of files in IRP_MJ_CLEANUP. (Permanent Delete not
recycle bin ) I can catch them in IRP_MJ_CLEANUP as

irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);

I am aware of the way with SET_INFORMATION -> FileDispositionInformation but
want to do it in IRP_MJ_CLEANUP. Any ideas?

Anurag

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Some playing around has helped me Fail permanent delete like this .

irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);
*( &fileObject->DeletePending) == 0x00; // “position 1”
Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_UNSUCCESSFUL;
}

But I have another problem.
I am not able to rename the file in the file object alter “position 1” .

I take the file handle by doing ZwOpenFile or ZwCreateFile and rename
with ZwSetInformationFile
It works well in IRP_MJ_SETINFORMATION dispatch routine but not in
IRP_MJ_CLEANUP dispatch routine .

Any ideas???

anurag

-----Original Message-----
From: Ted Hess [mailto:xxxxx@livevault.com]
Sent: Wednesday, October 27, 2004 1:42 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Fail delete in IRP_MJ_CLEANUP

IIRC files marked for deletion by using the CREATE option:
FILE_DELETE_ON_CLOSE cannot be revoked.

Other than that detail, you could send a SET_INFORMATION ->
FileDispositionInformation = 0 before the CLEANUP to clear any other
cases.

/ted

-----Original Message-----
From: Anurag Sarin [mailto:xxxxx@divassoftware.com]
Sent: Tuesday, October 26, 2004 1:19 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Fail delete in IRP_MJ_CLEANUP

Can I prevent deletion of files in IRP_MJ_CLEANUP. (Permanent Delete not
recycle bin ) I can catch them in IRP_MJ_CLEANUP as

irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);

I am aware of the way with SET_INFORMATION -> FileDispositionInformation
but want to do it in IRP_MJ_CLEANUP. Any ideas?

Anurag

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@divassoftware.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

4

You should never block IRP_MJ_CLEANUP requests. By doing so you leave file
system in inconsistent state. For example in your case file system stores
“pending deletion” flag in FCB (in addition to FileObject->DeletePending
flag) and denies further create requests.
If you want to “unmark” file for deletion you need to use
IRP_MJ_SET_INFORMATION/DispositionInformation with DeleteFile == FALSE
before you send IRP_MJ_CLEANUP to the file system.

Alexei.

“Anurag Sarin” wrote in message
news:xxxxx@ntfsd…
Some playing around has helped me Fail permanent delete like this .
---------------------------------------------
irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);
*( &fileObject->DeletePending) == 0x00; // “position 1”
Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_UNSUCCESSFUL;
}
-------------------------------------------------

But I have another problem.
I am not able to rename the file in the file object alter “position 1” .

I take the file handle by doing ZwOpenFile or ZwCreateFile and rename
with ZwSetInformationFile
It works well in IRP_MJ_SETINFORMATION dispatch routine but not in
IRP_MJ_CLEANUP dispatch routine .

Any ideas???

anurag

-----Original Message-----
From: Ted Hess [mailto:xxxxx@livevault.com]
Sent: Wednesday, October 27, 2004 1:42 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Fail delete in IRP_MJ_CLEANUP

IIRC files marked for deletion by using the CREATE option:
FILE_DELETE_ON_CLOSE cannot be revoked.

Other than that detail, you could send a SET_INFORMATION ->
FileDispositionInformation = 0 before the CLEANUP to clear any other
cases.

/ted

-----Original Message-----
From: Anurag Sarin [mailto:xxxxx@divassoftware.com]
Sent: Tuesday, October 26, 2004 1:19 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Fail delete in IRP_MJ_CLEANUP

Can I prevent deletion of files in IRP_MJ_CLEANUP. (Permanent Delete not
recycle bin ) I can catch them in IRP_MJ_CLEANUP as
---------------------------------------------
irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);
-------------------------------------------------

I am aware of the way with SET_INFORMATION -> FileDispositionInformation
but want to do it in IRP_MJ_CLEANUP. Any ideas?

Anurag

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@divassoftware.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

5

It is not advisable that you fail IRP_MJ_CLEANUP. If
you want to protect files from being deleted do it in
IRP_MJ_SET_INFORMATION/FileDisposition. If you want to
protect files from DELETE_ON_CLOSE, do it in
IRP_MJ_CREATE.

You should be able to set the DeletePending to FALSE
in IRP_MJ_CLEANUP provided it was set TRUE in
IRP_MJ_SET_INFORMATION. But you won’t be able to
protect files which are opened by DELETE_ON_CLOSE
because you have no way to tell the underlying file
system to unset its internal flag. Thus it is better
to avoid doing your processing in IRP_MJ_CLEANUP
dispatch and I strongly advise not failing it.

Best regards,
Razvan

— Anurag Sarin wrote:

> Some playing around has helped me Fail permanent
> delete like this .
> ---------------------------------------------
> irpStack = IoGetCurrentIrpStackLocation( Irp );
> fileObject = irpStack->FileObject;
>
> if ( *( &fileObject->DeletePending) == 0x01)
> {
> DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);
> *( &fileObject->DeletePending) == 0x00; //
> “position 1”
> Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;
> Irp->IoStatus.Information = 0;
> IoCompleteRequest(Irp, IO_NO_INCREMENT);
> return STATUS_UNSUCCESSFUL;
> }
> -------------------------------------------------
>
> But I have another problem.
> I am not able to rename the file in the file object
> alter “position 1” .
>
> I take the file handle by doing ZwOpenFile or
> ZwCreateFile and rename
> with ZwSetInformationFile
> It works well in IRP_MJ_SETINFORMATION dispatch
> routine but not in
> IRP_MJ_CLEANUP dispatch routine .
>
>
> Any ideas???
>
> anurag
>
> -----Original Message-----
> From: Ted Hess [mailto:xxxxx@livevault.com]
> Sent: Wednesday, October 27, 2004 1:42 AM
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] Fail delete in IRP_MJ_CLEANUP
>
>
> IIRC files marked for deletion by using the CREATE
> option:
> FILE_DELETE_ON_CLOSE cannot be revoked.
>
> Other than that detail, you could send a
> SET_INFORMATION ->
> FileDispositionInformation = 0 before the CLEANUP to
> clear any other
> cases.
>
> /ted
>
> -----Original Message-----
> From: Anurag Sarin [mailto:xxxxx@divassoftware.com]
>
> Sent: Tuesday, October 26, 2004 1:19 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Fail delete in IRP_MJ_CLEANUP
>
>
>
> Can I prevent deletion of files in IRP_MJ_CLEANUP.
> (Permanent Delete not
> recycle bin ) I can catch them in IRP_MJ_CLEANUP as
> ---------------------------------------------
> irpStack = IoGetCurrentIrpStackLocation( Irp );
> fileObject = irpStack->FileObject;
>
> if ( *( &fileObject->DeletePending) == 0x01)
> {
> DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);
> -------------------------------------------------
>
>
> I am aware of the way with SET_INFORMATION ->
> FileDispositionInformation
> but want to do it in IRP_MJ_CLEANUP. Any ideas?
>
> Anurag
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument:
> ‘’ To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@divassoftware.com To
> unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo

6

Yes, you can change the delete disposition of a file while processing
the pre-cleanup operation. You do in by generating a set disposition
operation to clear the delete disposition.

There is no way of changing the delete state of a file that was opened
for delete after the create has completed.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Anurag Sarin
Sent: Tuesday, October 26, 2004 10:19 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Fail delete in IRP_MJ_CLEANUP

Can I prevent deletion of files in IRP_MJ_CLEANUP. (Permanent Delete not
recycle bin ) I can catch them in IRP_MJ_CLEANUP as

irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);

I am aware of the way with SET_INFORMATION -> FileDispositionInformation
but want to do it in IRP_MJ_CLEANUP. Any ideas?

Anurag

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

> There is no way of changing the delete state of a file that was opened

for delete after the create has completed.

Wow!

So, I cannot use ZwSetInformationFile/DispositionInformation to reset the
DeleteOnClose flag if it was set by FILE_DELETE_ON_CLOSE in ZwCreateFile?

Is this behaviour documented? I remember hitting it once in some code which
opened files from kmode, and should delete them if something went wrong while
writing to them.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

8

Maxim,

As I mentioned in an older post, no, that is not
possible. ZwSetInformationFile/DispositionInformation
will not reset the flag related to
FILE_DELETE_ON_CLOSE in ZwCreateFile.

Razvan

— “Maxim S. Shatskih”
wrote:

> > There is no way of changing the delete state of a
> file that was opened
> > for delete after the create has completed.
>
> Wow!
>
> So, I cannot use
> ZwSetInformationFile/DispositionInformation to reset
> the
> DeleteOnClose flag if it was set by
> FILE_DELETE_ON_CLOSE in ZwCreateFile?
>
> Is this behaviour documented? I remember hitting it
> once in some code which
> opened files from kmode, and should delete them if
> something went wrong while
> writing to them.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>

__________________________________
Do you Yahoo!?
Yahoo! Mail Address AutoComplete - You start. We finish.
http://promotions.yahoo.com/new_mail

9

The point is, that FILE_DELETE_ON_CLOSE from IRP_MJ_CREATE for some file
object will not propagate into FileDispositionInformation until the fsd
processes IRP_MJ_CLEANUP for said file object, and in the meantime there is
no way to revoke the FILE_DELETE_ON_CLOSE.

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
>> There is no way of changing the delete state of a file that was opened
>> for delete after the create has completed.
>
> Wow!
>
> So, I cannot use ZwSetInformationFile/DispositionInformation to reset the
> DeleteOnClose flag if it was set by FILE_DELETE_ON_CLOSE in ZwCreateFile?
>
> Is this behaviour documented? I remember hitting it once in some code
> which
> opened files from kmode, and should delete them if something went wrong
> while
> writing to them.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>

10

So what is the trouble with …

In your filter driver, every time you receive IRP_MJ_CLEANUP, in dispatch,
you go open the file again yourself get a brand new handle. Now in
completion of the IRP_MJ_CLEANUP send
IRP_MJ_SET_INFORMATION/FileDispositionInformation on your brand new handle
from dispatch, then close your brand new handle.

“Neal Christiansen” wrote in message
news:xxxxx@ntfsd…
Yes, you can change the delete disposition of a file while processing
the pre-cleanup operation. You do in by generating a set disposition
operation to clear the delete disposition.

There is no way of changing the delete state of a file that was opened
for delete after the create has completed.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Anurag Sarin
Sent: Tuesday, October 26, 2004 10:19 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Fail delete in IRP_MJ_CLEANUP

Can I prevent deletion of files in IRP_MJ_CLEANUP. (Permanent Delete not
recycle bin ) I can catch them in IRP_MJ_CLEANUP as
---------------------------------------------
irpStack = IoGetCurrentIrpStackLocation( Irp );
fileObject = irpStack->FileObject;

if ( *( &fileObject->DeletePending) == 0x01)
{
DbgPrint(“\nSpyClose:Delete IRP:%x”,Irp);
-------------------------------------------------

I am aware of the way with SET_INFORMATION -> FileDispositionInformation
but want to do it in IRP_MJ_CLEANUP. Any ideas?

Anurag

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

11

Not only that Max, but you can delete an existing file by specifying
FILE_DELETE_ON_CLOSE + FILE_OPEN with DELETE access in your CREATE. Then
just CLOSE it!

/ted

-----Original Message-----
From: Maxim S. Shatskih [mailto:xxxxx@storagecraft.com]
Sent: Sunday, October 31, 2004 2:42 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Fail delete in IRP_MJ_CLEANUP

There is no way of changing the delete state of a file that was opened
for delete after the create has completed.

Wow!

So, I cannot use ZwSetInformationFile/DispositionInformation to reset the
DeleteOnClose flag if it was set by FILE_DELETE_ON_CLOSE in ZwCreateFile?

Is this behaviour documented? I remember hitting it once in some code which
opened files from kmode, and should delete them if something went wrong
while writing to them.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com